Menu
Detect and verify subdomain takeover via dangling CNAME to unclaimed services.
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/uphiago/recon-skills --skill subdomain-takeover-huntThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
Based on SOC occupation classification
| name | subdomain-takeover-hunt |
| description | Detect and verify subdomain takeover via dangling CNAME to unclaimed services. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, python3, subfinder, dnsx |
| tags | ["recon","subdomain","takeover","CNAME","DNS","cloud","Heroku","S3","Azure"] |
| category | recon |
| related_skills | ["subdomain-enumeration","origin-ip-discovery","port-service-discovery"] |
Detect subdomains pointing to unregistered or unclaimed third-party cloud services. When a CNAME record points to a service that no longer exists, an attacker can register that resource and serve arbitrary content under the target's subdomain — enabling phishing, cookie theft, and full origin impersonation.
terminal with curl, dnsx, subfinder.subzy or subjack installed for automated detection.subdomain-enumeration.# DNS resolution with CNAME extraction
dnsx -retry 3 -a -cname -resp -silent -l alive_subs.txt | tee dns_records.txt
# Automated takeover scan
subzy run --targets alive_subs.txt --hide_fails --vuln
# Get all CNAME records
cat alive_subs.txt | dnsx -silent -cname -resp-only > cname_targets.txt
# Filter to suspicious services
grep -iE "heroku|s3\.amazonaws|azure|zendesk|shopify|github\.io|bitbucket|surge\.sh|netlify|vercel|ghost\.io|readme|statuspage|pantheon|desk\.com|campaignmonitor|intercom|unbounce|wordpress\.com|cargo\.collective" \
cname_targets.txt > takeover_candidates.txt
# subzy — fast, shows vulnerable + fingerprint
subzy run --targets alive_subs.txt --hide_fails --vuln
# subjack — with custom fingerprints
subjack -w alive_subs.txt -t 100 -timeout 30 -o takeover_results.txt \
-ssl -c ~/subjack/fingerprints.json -v
# nuclei — takeover templates
nuclei -l alive_subs.txt \
-t nuclei-templates/takeovers/ \
-o nuclei_takeover_results.txt
# For each candidate, verify the service is claimable
CANDIDATE=
dig CNAME +short
curl --max-time 30 --connect-timeout 10 -skI | -10
subfinder -d target.com -silent \
| dnsx -silent -cname \
| grep "s3.amazonaws" \
| while read line; do
sub=$(echo "$line" | awk '{print $1}' | sed 's/\.$//')
curl --max-time 30 --connect-timeout 10 -sk "https://$sub" | grep -q "NoSuchBucket" && echo "CLAIMABLE: $sub"
done
| Service | Error message or indicator | Claimable signal |
|---|---|---|
| Heroku | "No such app" / "There's nothing here" | Yes |
| S3 | "NoSuchBucket" / "The specified bucket does not exist" | Yes |
| Azure | "tenant not found" / "This tenant is not found" | Yes |
| Zendesk | "account not found" / "Help Center Closed" | Yes |
| GitHub Pages | 404 "There isn't a GitHub Pages site here" | Yes |
| Shopify | "Sorry, this shop is currently unavailable" | Yes |
| Netlify | "Not Found" / "Site not found" | Yes |
| Vercel | 404 — "DEPLOYMENT_NOT_FOUND" | Yes |
| Bitbucket | "Repository not found" | Yes |
| Surge.sh | "project not found" | Yes |
| Readme.io | "Project not found" | Yes |
| Statuspage | 404 — status page not found | Yes |
| Desk.com | "This site is currently not available" | Yes |
| Campaign Monitor | "Trying to get your email from" | Yes |
| Intercom | "This page is reserved for Intercom customers" | Yes |
| Unbounce | "The requested URL was not found" | Yes |
| WordPress.com | "Do you want to register domain.wordpress.com?" | Yes |
*.target.com → IP) produces false positives. Filter out wildcard responses before scanning for takeover.dig SUBDOMAIN CNAME +short returns a service with user-registrable namespace.curl --max-time 30 --connect-timeout 10 -sk https://SUBDOMAIN returns the service-specific error page indicating the resource is available.subdomain-enumeration — Generate the subdomain list for takeover scanning.origin-ip-discovery — If takeover is found, check if the same IP hosts other services.port-service-discovery — Scan the CNAME-resolved IP for additional exposed services.